[PATCH 01/21] exec: do not act on a stale execfd request without an executable

[Christian Brauner <brauner@kernel.org>]

binfmt_misc sets bprm->have_execfd (and, for a 'C' entry, execfd_creds)
before it opens the interpreter. When that open fails the entry returns
-ENOEXEC, but the two flags stay set on the bprm. As binfmt_misc is
inserted at the head of the format list, the search then continues to a
later format which never staged an interpreter, so bprm->executable is
NULL while the flags falsely claim an execfd is present.

begin_new_exec() then dereferences the missing executable:

  - bprm_creds_from_file() computes credentials from
    execfd_creds ? bprm->executable : bprm->file and faults on the NULL;
  - would_dump(bprm, bprm->executable) faults the same way; and
  - create_elf_tables() would emit AT_EXECFD from the zero-initialised
    bprm->execfd, handing the program descriptor 0.

An unprivileged user can reach this. Mount binfmt_misc in a user
namespace, register an 'O' or 'C' entry whose interpreter lives on a
FUSE mount, have the FUSE server fail the open with -ENOEXEC (which
fuse_dev_do_write() relays verbatim), and execute a native ELF file
matching the entry. The result is a NULL pointer dereference in
begin_new_exec().

have_execfd and execfd_creds only mean anything alongside the
bprm->executable they describe. Clear them when no executable was
staged, before the first dereference, so the exec proceeds as the plain
execution of the binary it has become.

Fixes: bc2bf338d54b ("exec: Remove recursion from search_binary_handler")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 fs/exec.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/exec.c b/fs/exec.c
index c698aabe9abd..2f50aa039827 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1112,6 +1112,12 @@ int begin_new_exec(struct linux_binprm * bprm)
 	struct task_struct *me = current;
 	int retval;
 
+	/* A declined execfd request has no executable for a later format. */
+	if (!bprm->executable) {
+		bprm->have_execfd = 0;
+		bprm->execfd_creds = 0;
+	}
+
 	/* Once we are committed compute the creds */
 	retval = bprm_creds_from_file(bprm);
 	if (retval)

-- 
2.53.0